CVE-2025-10882: Autodesk Shared Components Buffer Overflow

CVE-2025-10882 Overview

CVE-2025-10882 is an out-of-bounds write vulnerability [CWE-787] affecting Autodesk Shared Components and a broad range of Autodesk 2026 products. The flaw is triggered when a maliciously crafted Parasolid (X_T) file is parsed by an affected application. An attacker who convinces a user to open a crafted file can cause the application to crash, corrupt memory, or execute arbitrary code in the context of the current process. Exploitation requires local user interaction, but the affected product line spans widely deployed engineering, CAD, and BIM tools used across manufacturing, construction, and infrastructure sectors.

Critical Impact
A successful exploit allows arbitrary code execution under the privileges of the user running the affected Autodesk product, enabling endpoint compromise via a single crafted X_T file.

Affected Products

Autodesk Shared Components, AutoCAD 2026 and AutoCAD verticals (Architecture, Electrical, Map 3D, Mechanical, MEP, Plant 3D)
Autodesk 3ds Max 2026, Advance Steel 2026, Civil 3D 2026, InfraWorks 2026, Inventor 2026
Autodesk Revit 2026, Revit LT 2026, and Vault 2026

Discovery Timeline

2025-12-16 - CVE-2025-10882 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10882

Vulnerability Analysis

The vulnerability resides in the Parasolid (X_T) file parser shared by multiple Autodesk products through the Autodesk Shared Components library. When the parser processes a malformed X_T model file, it writes data past the bounds of an allocated buffer. This out-of-bounds write [CWE-787] corrupts adjacent memory structures, which an attacker can shape to hijack control flow. Because Autodesk Shared Components are reused across AutoCAD, Revit, Inventor, 3ds Max, Civil 3D, and other 2026 products, a single parser defect creates a uniform attack surface across the entire Autodesk 2026 product line.

Root Cause

The root cause is missing or insufficient bounds validation when the parser consumes geometric or structural fields inside a Parasolid X_T file. Untrusted size or index values from the file are used to drive write operations into fixed-size buffers without verifying they remain within the allocated region.

Attack Vector

Exploitation requires local user interaction. An attacker delivers a crafted X_T file through email, a shared drawing repository, a supplier exchange, or a project collaboration portal. When the user opens or imports the file into an affected Autodesk product, the parser triggers the out-of-bounds write. Code executes with the privileges of the logged-on user, providing a foothold for further activity such as credential theft, lateral movement, or deployment of additional payloads.

No verified proof-of-concept code is publicly available. See the Autodesk Security Advisory ADSK-SA-2025-0024 for vendor technical details.

Detection Methods for CVE-2025-10882

Indicators of Compromise

Unexpected crashes, hangs, or Windows Error Reporting (WER) entries from Autodesk processes such as acad.exe, revit.exe, inventor.exe, or 3dsmax.exe shortly after opening an X_T file.
X_T files arriving from external or untrusted sources, particularly via email attachments, web downloads, or partner file-exchange portals.
Autodesk product processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe.

Detection Strategies

Monitor process creation events where Autodesk parent processes launch script interpreters or living-off-the-land binaries.
Inspect file-write and network-connection telemetry originating from Autodesk processes immediately after X_T files are accessed.
Correlate application crash telemetry with recent X_T file open events on engineering workstations.

Monitoring Recommendations

Forward EDR process, file, and network telemetry from CAD and BIM workstations to a centralized analytics platform for behavioral analysis.
Alert on X_T files transiting email gateways or shared collaboration platforms from unverified senders.
Track Autodesk product versions across the fleet to identify hosts still running vulnerable 2026 builds.

How to Mitigate CVE-2025-10882

Immediate Actions Required

Apply the fixed releases identified in Autodesk Security Advisory ADSK-SA-2025-0024 to all affected 2026 products and to Autodesk Shared Components.
Inventory Autodesk installations across engineering, design, and contractor workstations and prioritize patching of internet-connected and externally-facing users.
Instruct users to avoid opening X_T files received from untrusted or unverified sources until patches are deployed.

Patch Information

Autodesk has published fixed versions and remediation guidance in Autodesk Security Advisory ADSK-SA-2025-0024. Because the defect lies in Autodesk Shared Components, updating individual products may require updating the shared library as delivered through Autodesk Access. Review the advisory for the specific fixed build numbers for each affected product.

Workarounds

Block or quarantine X_T attachments at email and web gateways pending patch deployment.
Restrict import of Parasolid files to a vetted location reviewed by engineering leads before opening.
Run Autodesk products under standard user accounts rather than administrative accounts to limit impact of arbitrary code execution.

bash

# Example: enumerate installed Autodesk 2026 products on Windows endpoints
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like "Autodesk*2026*" } |
  Select-Object DisplayName, DisplayVersion, InstallDate